Multi-application security testing method and device, electronic equipment and computer readable medium

Abstract

This disclosure provides embodiments of a multi-application security testing method, apparatus, electronic device, and computer-readable medium. One specific implementation of the method includes performing the following steps on each container corresponding to a deployed application: activating an application probe; obtaining the network protocol address of the current container and querying the corresponding container deployment version information based on the network protocol address; receiving data traffic collected by the application probe and tagging the data traffic according to the container deployment version information to generate tagged data traffic; performing security analysis on the tagged data traffic to generate security analysis traffic; clustering the obtained security analysis traffic to generate a clustered analysis traffic set; and controlling each target container to stop running based on the clustered analysis traffic set and the determined container deployment version information. This implementation can accurately identify the problematic application and its version.

Description

Technical Field

[0001] Embodiments of this disclosure relate to the field of computer technology, and more specifically to multi-application security testing methods, apparatus, electronic devices, and computer-readable media. Background Technology

[0002] With the continuous development of internet applications, the demand for application security protection is increasing, and how to automate application security testing has become an important research topic. Currently, the common method for application security testing is to implant probes into the application under test and use a security analysis engine to analyze the traffic acquired by the probes.

[0003] However, when using the above methods to conduct security testing on applications, the following technical problems often arise:

[0004] First, when there are many applications under test, different applications have different application versions, and different versions are deployed in different groups and units. When the probe is implanted into the application under test and the security analysis engine is used to analyze the traffic obtained by the probe, it is impossible to map the problematic traffic to different applications and different application versions, which makes it impossible to determine the problematic application and application version.

[0005] Second, when the probe is implanted into the application under test and the security analysis engine is used to analyze the traffic obtained by the probe, no collection rules are defined. This results in a large amount of traffic being collected when there are many applications under test, and it takes a long time to filter the collected traffic.

[0006] Third, when analyzing traffic using the security rules included in the security engine, it can only identify the container with the vulnerability, but not the cause of the vulnerability. This requires using other methods to identify the vulnerability again, which takes a long time to fix the vulnerability in the container. Summary of the Invention

[0007] The summary portion of this disclosure is intended to provide a brief overview of the concepts, which will be described in detail in the detailed description portion. This summary portion is not intended to identify key or essential features of the claimed technical solutions, nor is it intended to limit the scope of the claimed technical solutions.

[0008] Some embodiments of this disclosure provide multi-application security testing methods, apparatuses, electronic devices, and computer-readable media to address one or more of the technical problems mentioned in the background section above.

[0009] In a first aspect, some embodiments of this disclosure provide a multi-application security testing method. The method includes: in response to receiving application deployment completion information, performing the following processing steps on the container corresponding to each deployed application: in response to the current time being a preset startup time, starting an application probe; obtaining the network protocol address of the current container, and querying the corresponding container deployment version information based on the network protocol address; receiving data traffic collected by the application probe, and tagging the data traffic based on the container deployment version information to generate tagged data traffic; performing security analysis on the tagged data traffic to generate security analysis traffic; clustering the obtained security analysis traffic to generate a clustered analysis traffic set; and controlling each target container to stop running based on the clustered analysis traffic set and the determined container deployment version information.

[0010] Secondly, some embodiments of this disclosure provide a multi-application security testing apparatus, comprising: a processing unit configured to, in response to receiving application deployment completion information, perform the following processing steps for each container corresponding to the deployed application: in response to the current time being a preset startup time, start an application probe; obtain the network protocol address of the current container, and query the corresponding container deployment version information based on the network protocol address; receive data traffic collected by the application probe, and, based on the container deployment version information, tag the data traffic to generate tagged data traffic; perform security analysis on the tagged data traffic to generate security analysis traffic; a clustering unit configured to cluster the obtained security analysis traffic to generate a clustered analysis traffic set; and a stopping unit configured to control each target container to stop running based on the clustered analysis traffic set and the determined container deployment version information.

[0011] Thirdly, some embodiments of this disclosure provide an electronic device, including: one or more processors; and a storage device having one or more programs stored thereon, wherein when the one or more programs are executed by the one or more processors, the one or more processors implement the method described in any implementation of the first aspect above.

[0012] Fourthly, some embodiments of this disclosure provide a computer-readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the method described in any of the implementations of the first aspect above.

[0013] The above embodiments of this disclosure have the following beneficial effects: The multi-application security testing method of some embodiments of this disclosure can accurately determine the problematic application and its version. Specifically, the reason for the inability to determine the problematic application is that when there are many applications under test, different applications have different versions, and different versions are deployed in different groups and units. When a probe is implanted into the application under test and the security analysis engine is used to analyze the traffic obtained by the probe, it is impossible to map the problematic traffic to different applications and different application versions, thus making it impossible to determine the problematic application and its version. Based on this, the multi-application security testing method of some embodiments of this disclosure firstly, in response to receiving application deployment completion information, performs the following processing steps for the container corresponding to each deployed application: Firstly, in response to the current time being a preset startup time, the application probe is started. Thus, the traffic of the application deployed within the container can be obtained through the application probe. Secondly, the network protocol address of the current container is obtained, and the corresponding container deployment version information is queried based on the network protocol address. Thus, the container information of the current container can be determined through the network protocol address. Then, the data traffic collected by the application probes is received, and the data traffic is tagged according to the container deployment version information to generate tagged data traffic. This allows matching of container information with the traffic acquired by the application probes, enabling rapid identification of the corresponding container, the application deployed within the container, and its version when risky data traffic is detected. Next, security analysis is performed on the tagged data traffic to generate security analysis traffic. This determines whether risky data traffic exists within the tagged data traffic. Then, the obtained security analysis traffic is clustered to generate clustered analysis traffic sets. This allows security analysis traffic of the same category to be clustered. Finally, based on the clustered analysis traffic sets and the identified container deployment version information, each target container is stopped. Thus, by using the clustered analysis traffic sets and corresponding container information, the container corresponding to the risky data traffic, as well as the application deployed within the container and its version, can be identified. This allows for accurate identification of the problematic application and its version. Attached Figure Description

[0014] The above and other features, advantages, and aspects of the embodiments of this disclosure will become more apparent from the accompanying drawings and the following detailed description. Throughout the drawings, the same or similar reference numerals denote the same or similar elements. It should be understood that the drawings are schematic, and elements are not necessarily drawn to scale.

[0015] Figure 1 This is a flowchart of some embodiments of the multi-application security testing method according to the present disclosure;

[0016] Figure 2 These are schematic diagrams illustrating the structure of some embodiments of the multi-application security testing apparatus according to this disclosure;

[0017] Figure 3 This is a schematic diagram of the structure of an electronic device suitable for implementing some embodiments of the present disclosure. Detailed Implementation

[0018] Embodiments of this disclosure will now be described in more detail with reference to the accompanying drawings. While some embodiments of this disclosure are shown in the drawings, it should be understood that this disclosure can be implemented in various forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided to provide a more thorough and complete understanding of this disclosure. It should be understood that the accompanying drawings and embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of protection of this disclosure.

[0019] It should also be noted that, for ease of description, only the parts relevant to the invention are shown in the accompanying drawings. Unless otherwise specified, the embodiments and features described in this disclosure can be combined with each other.

[0020] It should be noted that the concepts of "first" and "second" mentioned in this disclosure are used only to distinguish different devices, modules or units, and are not used to limit the order of functions performed by these devices, modules or units or their interdependencies.

[0021] It should be noted that the terms "a" and "a plurality of" used in this disclosure are illustrative rather than restrictive, and those skilled in the art should understand that, unless otherwise expressly indicated in the context, they should be understood as "one or more".

[0022] The names of messages or information exchanged between multiple devices in the embodiments of this disclosure are for illustrative purposes only and are not intended to limit the scope of such messages or information.

[0023] This disclosure will now be described in detail with reference to the accompanying drawings and embodiments.

[0024] Figure 1 A flow 100 of some embodiments of a multi-application security testing method according to the present disclosure is shown. This multi-application security testing method includes the following steps:

[0025] Step 101: In response to receiving the application deployment completion information, perform the following processing steps for each container corresponding to the deployed application:

[0026] Step 1011: In response to the current time being the preset startup time, start the application probe.

[0027] In some embodiments, the entity executing the multi-application security testing method (e.g.) Figure 1 The computing device 101 shown can launch an application probe in response to the current time being a preset launch time. The preset launch time can be a pre-defined time for launching the application probe. The application probe can be an interface used to acquire application traffic.

[0028] Step 1012: Obtain the network protocol address of the current container, and query the corresponding container deployment version information based on the network protocol address.

[0029] In some embodiments, the execution entity can obtain the network protocol address of the current container and query the corresponding container deployment version information based on the network protocol address. In practice, the execution entity can obtain the network protocol address of the current container through a pre-defined command line. The network protocol address can be an IP address (Internet Protocol Address). The container deployment version information can be the container information of the current container. The container deployment version information can include, but is not limited to: the application version number, application code, code branch, group information, and instance ID of the current container deployment. The application version number can be the version number of the application deployed in the current container. The application code can uniquely identify a specific application. The code branch can be the code branch of the deployed application. The group information can be the information of the group to which the current container belongs. The instance ID can uniquely identify the application instance of the application deployed in the current container. Here, the container deployment version information corresponding to the aforementioned network protocol address can be queried through the associated operation and maintenance platform interface.

[0030] Step 1013: Receive the data traffic collected by the application probe, and label the data traffic according to the container deployment version information to generate labeled data traffic.

[0031] In some embodiments, the execution entity may receive data traffic collected by the application probe and, based on the container deployment version information, tag the data traffic to generate tagged data traffic. In practice, the execution entity may add the container deployment version information to the attribute information included in the data traffic to update the attribute information and determine the updated traffic information as tagged data traffic.

[0032] In practice, the aforementioned execution entity can receive the data traffic collected by the application probe through the following steps:

[0033] The first step is to obtain the set of traffic collection rule information stored in the target database. The target database can be a database that stores the set of traffic collection rule information. The traffic collection rule information in this set can be pre-defined rules used to filter traffic.

[0034] The second step is to send the above traffic collection rule information set to the above application probe.

[0035] The third step is to receive the data traffic collected by the application probes. This data traffic can be the traffic collected by the application probes according to the aforementioned traffic collection rule information set.

[0036] Optionally, after the third step, in response to receiving at least one new traffic collection rule information sent by the target terminal, for each of the above-mentioned new traffic collection rule information, the following processing steps are performed:

[0037] The first processing step is to determine whether the newly added traffic collection rule information is the same as any traffic collection rule information in the above traffic collection rule information set.

[0038] The second processing step is to add the newly added traffic collection rule information to the traffic collection rule information set in response to determining that the newly added traffic collection rule information is different from any traffic collection rule information in the traffic collection rule information set, so as to update the traffic collection rule information set.

[0039] The technical content in steps one through three above, as well as in optional sections, constitutes an inventive point of this disclosure, solving the second technical problem mentioned in the background: "When embedding a probe into the application under test and using a security analysis engine to analyze the traffic acquired by the probe, the lack of defined collection rules leads to a large amount of traffic being collected when there are many applications under test, requiring a long time to filter the collected traffic." The factors causing this long filtering time for collected traffic are often as follows: When embedding a probe into the application under test and using a security analysis engine to analyze the traffic acquired by the probe, the lack of defined collection rules leads to a large amount of traffic being collected when there are many applications under test, requiring a long time to filter the collected traffic. Solving these factors can reduce the time spent filtering collected traffic. To achieve this, firstly, the traffic collection rule information set stored in the target database is obtained. This allows the acquisition of pre-defined collection rules. Secondly, the aforementioned traffic collection rule information set is sent to the application probe. Thus, the application probe can filter the collected traffic according to the received collection rules, thereby reducing the time spent filtering collected traffic at the application probe level. Third, it receives the data traffic collected by the application probes mentioned above. This allows it to receive the traffic filtered by the application probes, reducing the time spent filtering the collected traffic.

[0040] Step 1014: Perform security analysis on the tagged data traffic to generate security analysis traffic.

[0041] In some embodiments, the aforementioned execution entity may perform security analysis on the aforementioned tagging data traffic to generate security analysis traffic.

[0042] In practice, the aforementioned implementing entities can perform security analysis on the above-mentioned tagging data traffic through the following steps to generate security analysis traffic:

[0043] The first step is to send the tagged data traffic to a preset security engine. This preset security engine includes a set of preset security algorithms. These preset security algorithms can be pre-defined algorithms used for security analysis to determine whether risky traffic exists within the traffic.

[0044] In practice, the aforementioned executing entity can send the tagged data traffic to the preset security engine through the following steps: First, obtain the data forwarding interface information. This data forwarding interface information can be the interface information of the forwarding interface used to forward the tagged data traffic. Then, determine the target forwarding interface based on the data forwarding interface information. In practice, the forwarding interface corresponding to the aforementioned data forwarding interface information can be determined as the target forwarding interface. Finally, based on the target forwarding interface, send the tagged data traffic to the preset security engine. In practice, the aforementioned executing entity can send the tagged data traffic to the preset security engine through the aforementioned target forwarding interface.

[0045] The second step involves performing security analysis on the tagged data traffic based on the set of preset security rules included in the aforementioned preset security engine, in order to generate risky traffic. In practice, the tagged data traffic is analyzed using the various preset security rules in the aforementioned set of preset security rules, and the traffic segments containing risks within the tagged data traffic are identified as risky traffic.

[0046] The third step involves determining the risk container information based on the tagging information included in the aforementioned risk traffic, and adding this risk container information to the tagged data traffic to update the compliant data traffic, thus obtaining the security analysis traffic. In practice, the container deployment version information of the container corresponding to the tagging information included in the aforementioned risk traffic can be used to determine the risk container information.

[0047] In some optional implementations of certain embodiments, the aforementioned execution entity can transmit the tagged data traffic to a security analysis chip to generate security analysis traffic. In practice, firstly, the aforementioned execution entity can obtain information about at least one dependent component corresponding to the tagged data traffic. Secondly, the aforementioned execution entity can transmit the tagged data traffic and the information about at least one dependent component to the aforementioned security analysis chip to generate security analysis traffic. Here, the aforementioned security analysis chip can be a pre-configured chip that is communicatively connected to the aforementioned execution entity for analyzing the tagged data traffic. The aforementioned security analysis chip is deployed with a security analysis model. The aforementioned security analysis model can be divided into four layers: a first layer, an input layer, used to back up the input tagged data traffic to generate backup data traffic. A second layer, a processing layer, includes a first sub-model and a second sub-model. The first sub-model is used to mark taints in the backup data traffic and detect taint propagation, inputting the backup data traffic and outputting the marked backup data traffic. The second sub-model is used to analyze the dependent component information, determine abnormal components, inputting the information about at least one dependent component and outputting a set of abnormal component information. The third layer, the determination layer, is used to determine the complete flow information of taints. The fourth layer, the output layer, is used to analyze the complete flow information of taints output from the third layer to generate analysis information, and to combine the analysis information, tagged data flow, and abnormal component information set to generate security analysis flow as the output of the entire security analysis model.

[0048] The aforementioned optional technical content serves as an inventive point of this disclosure, solving the third technical problem mentioned in the background: "When analyzing traffic through security rules included in the security engine, only the container with the vulnerability can be identified, but the cause of the vulnerability cannot be determined, leading to the need to re-identify the vulnerability through other methods, which consumes a considerable amount of time to fix the vulnerability in the container." The factors causing the need for prolonged time to fix vulnerabilities in containers are often as follows: When analyzing traffic through security rules included in the security engine, only the container with the vulnerability can be identified, but the cause of the vulnerability cannot be determined, leading to the need to re-identify the vulnerability through other methods, which consumes a considerable amount of time to fix the vulnerability in the container. If these factors are resolved, the time required to fix vulnerabilities in containers can be reduced. To achieve this effect, this disclosure uses a security analysis chip. Through the security analysis model included in the security analysis chip, taints in the data traffic are marked, and the complete flow information of the taints is determined. This allows the determination of the cause and location of the vulnerability, enabling timely fixes and reducing the time required to fix vulnerabilities in containers.

[0049] Step 102: Cluster the obtained security analysis traffic to generate clustered analysis traffic sets.

[0050] In some embodiments, the aforementioned execution entity may cluster the obtained security analysis traffic to generate a clustered analysis traffic set.

[0051] In some optional implementations of certain embodiments, the aforementioned execution entity may cluster the security analysis traffic with the same container deployment version information corresponding to each security analysis traffic to generate a clustered analysis traffic set.

[0052] Step 103: Based on the cluster analysis of traffic groups and the determined deployment version information of each container, control each target container to stop running.

[0053] In some embodiments, the execution entity can control the shutdown of each target container based on the cluster analysis traffic group set and the determined container deployment version information. In practice, the execution entity can stop the operation of each container corresponding to each cluster analysis traffic group that includes risky traffic in the cluster analysis traffic group set.

[0054] The above embodiments of this disclosure have the following beneficial effects: The multi-application security testing method of some embodiments of this disclosure can accurately determine the problematic application and its version. Specifically, the reason for the inability to determine the problematic application is that when there are many applications under test, different applications have different versions, and different versions are deployed in different groups and units. When a probe is implanted into the application under test and the security analysis engine is used to analyze the traffic obtained by the probe, it is impossible to map the problematic traffic to different applications and different application versions, thus making it impossible to determine the problematic application and its version. Based on this, the multi-application security testing method of some embodiments of this disclosure firstly, in response to receiving application deployment completion information, performs the following processing steps for the container corresponding to each deployed application: Firstly, in response to the current time being a preset startup time, the application probe is started. Thus, the traffic of the application deployed within the container can be obtained through the application probe. Secondly, the network protocol address of the current container is obtained, and the corresponding container deployment version information is queried based on the network protocol address. Thus, the container information of the current container can be determined through the network protocol address. Then, the data traffic collected by the application probes is received, and the data traffic is tagged according to the container deployment version information to generate tagged data traffic. This allows matching of container information with the traffic acquired by the application probes, enabling rapid identification of the corresponding container, the application deployed within the container, and its version when risky data traffic is detected. Next, security analysis is performed on the tagged data traffic to generate security analysis traffic. This determines whether risky data traffic exists within the tagged data traffic. Then, the obtained security analysis traffic is clustered to generate clustered analysis traffic sets. This allows security analysis traffic of the same category to be clustered. Finally, based on the clustered analysis traffic sets and the identified container deployment version information, each target container is stopped. Thus, by using the clustered analysis traffic sets and corresponding container information, the container corresponding to the risky data traffic, as well as the application deployed within the container and its version, can be identified. This allows for accurate identification of the problematic application and its version.

[0055] Further reference Figure 2 As an implementation of the methods shown in the above figures, this disclosure provides some embodiments of a multi-application security testing device, which are similar to... Figure 1 Corresponding to the method embodiments shown, this multi-application security testing device can be specifically applied to various electronic devices.

[0056] like Figure 2As shown, a multi-application security testing apparatus 200 in some embodiments includes a processing unit 201, a clustering unit 202, and a stopping unit 203. The processing unit 201 is configured to, in response to receiving application deployment completion information, perform the following processing steps for each container corresponding to the deployed application: starting an application probe in response to the current time being a preset startup time; obtaining the network protocol address of the current container and querying the corresponding container deployment version information based on the network protocol address; receiving data traffic collected by the application probe and tagging the data traffic based on the container deployment version information to generate tagged data traffic; performing security analysis on the tagged data traffic to generate security analysis traffic; the clustering unit 202 is configured to cluster the obtained security analysis traffic to generate a clustered analysis traffic set; and the stopping unit 203 is configured to control each target container to stop running based on the clustered analysis traffic set and the determined container deployment version information.

[0057] It is understandable that the units described in the multi-application safety testing device 200 and the reference Figure 1 The steps in the described method correspond to each other. Therefore, the operations, features, and beneficial effects described above for the method also apply to the multi-application safety test apparatus 200 and the units contained therein, and will not be repeated here.

[0058] The following is for reference. Figure 3 This document illustrates a structural schematic of an electronic device 300 suitable for implementing some embodiments of the present disclosure. The electronic devices in some embodiments of the present disclosure may include, but are not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (personal digital assistants), PADs (tablet computers), PMPs (portable multimedia players), in-vehicle terminals (e.g., in-vehicle navigation terminals), and fixed terminals such as digital TVs and desktop computers. Figure 3 The electronic device shown is merely an example and should not be construed as limiting the functionality and scope of the embodiments of this disclosure.

[0059] like Figure 3 As shown, the electronic device 300 may include a processing unit 301 (e.g., a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 into a random access memory (RAM) 303. The RAM 303 also stores various programs and data required for the operation of the electronic device 300. The processing unit 301, ROM 302, and RAM 303 are interconnected via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0060] Typically, the following devices can be connected to I / O interface 305: input devices 306 including, for example, touchscreens, touchpads, keyboards, mice, cameras, microphones, accelerometers, gyroscopes, etc.; output devices 307 including, for example, liquid crystal displays (LCDs), speakers, vibrators, etc.; storage devices 308 including, for example, magnetic tapes, hard disks, etc.; and communication devices 309. Communication device 309 allows electronic device 300 to communicate wirelessly or wiredly with other devices to exchange data. Although Figure 3 An electronic device 300 with various devices is shown; however, it should be understood that it is not required to implement or possess all of the devices shown. More or fewer devices may be implemented or possessed alternatively. Figure 3 Each box shown can represent a device or multiple devices as needed.

[0061] In particular, according to some embodiments of this disclosure, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, some embodiments of this disclosure include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via communication device 309, or installed from storage device 308, or installed from ROM 302. When the computer program is executed by processing device 301, it performs the functions defined in the methods of some embodiments of this disclosure.

[0062] It should be noted that, in some embodiments of this disclosure, the computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium may be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage device, magnetic storage device, or any suitable combination thereof. In some embodiments of this disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In some embodiments of this disclosure, a computer-readable signal medium may include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A computer-readable signal medium can be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wires, optical fibers, RF (radio frequency), etc., or any suitable combination thereof.

[0063] In some implementations, clients and servers can communicate using any currently known or future-developed network protocol such as HTTP (Hypertext Transfer Protocol) and can interconnect with digital data communication (e.g., communication networks) of any form or medium. Examples of communication networks include local area networks (“LANs”), wide area networks (“WANs”), the Internet (e.g., the Internet of Things), and peer-to-peer networks (e.g., ad hoc peer-to-peer networks), as well as any currently known or future-developed networks.

[0064] The aforementioned computer-readable medium may be included within the aforementioned electronic device; or it may exist independently and not assembled into the electronic device. The aforementioned computer-readable medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to: in response to receiving application deployment completion information, perform the following processing steps for each container corresponding to the deployed application: in response to the current time being a preset startup time, start an application probe; obtain the network protocol address of the current container, and query the corresponding container deployment version information based on the network protocol address; receive the data traffic collected by the application probe, and, based on the container deployment version information, tag the data traffic to generate tagged data traffic; perform security analysis on the tagged data traffic to generate security analysis traffic; cluster the obtained security analysis traffic to generate clustered analysis traffic sets; and, based on the clustered analysis traffic sets and the determined container deployment version information, control each target container to stop running.

[0065] Computer program code for performing operations of some embodiments of this disclosure can be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, and C++, and conventional procedural programming languages ​​such as the "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as a standalone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In cases involving remote computers, the remote computer can be connected to the user's computer via any type of network—including a local area network (LAN) or a wide area network (WAN)—or can be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0066] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of this disclosure. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0067] The units described in some embodiments of this disclosure can be implemented in software or hardware. The described units can also be housed in a processor; for example, a processor may be described as including a processing unit, a clustering unit, and a stopping unit. The names of these units do not necessarily limit the unit itself; for example, a stopping unit may also be described as "a unit that controls the stopping of operation of each target container based on the above-described clustering analysis of traffic groups and the determined deployment version information of each container."

[0068] The functions described above in this document can be performed, at least in part, by one or more hardware logic components. For example, exemplary types of hardware logic components that can be used, without limitation, include: Field Programmable Gate Arrays (FPGAs), Application-Specific Integrated Circuits (ASICs), Application Standard Products (ASSPs), System-on-Chip (SoCs), Complex Programmable Logic Devices (CPLDs), and so on.

[0069] The above description is merely a selection of preferred embodiments of this disclosure and an explanation of the technical principles employed. Those skilled in the art should understand that the scope of the invention involved in the embodiments of this disclosure is not limited to technical solutions formed by specific combinations of the above-described technical features, but should also cover other technical solutions formed by arbitrary combinations of the above-described technical features or their equivalents without departing from the above-described inventive concept. For example, technical solutions formed by substituting the above-described features with (but not limited to) technical features with similar functions disclosed in the embodiments of this disclosure.

Claims

1. A multi-application security testing method, comprising: Upon receiving the application deployment completion information, the following processing steps are performed on the container corresponding to each deployed application: In response to the current time being the preset startup time, start the application probe; Obtain the network protocol address of the current container, and query the corresponding container deployment version information based on the network protocol address; The system receives data traffic collected by the application probe and tags the data traffic according to the container deployment version information to generate tagged data traffic. The marking data traffic is subjected to security analysis to generate security analysis traffic; The step of performing security analysis on the marking data traffic to generate security analysis traffic includes: The tagged data traffic is sent to a preset security engine, wherein the preset security engine includes a preset set of security algorithms; Based on the preset security algorithm set included in the preset security engine, the tagged data traffic is subjected to security analysis to generate risky traffic; Based on the tagging information included in the risk traffic, risk container information is determined, and the risk container information is added to the tagging data traffic to update the tagging data traffic and obtain security analysis traffic; The step of sending the tagging data traffic to the preset security engine includes: Obtain data forwarding interface information; Based on the data forwarding interface information, determine the target forwarding interface; According to the target forwarding interface, the tagged data traffic is sent to the preset security engine; The obtained security analysis traffic is clustered to generate clustered analysis traffic sets; Based on the cluster analysis of traffic groups and the determined deployment version information of each container, control each target container to stop running.

2. The method according to claim 1, wherein, The receiving of data traffic collected by the application probe includes: Obtain the set of traffic collection rule information stored in the target database; Send the traffic collection rule information set to the application probe; Receive the data traffic collected by the application probe, wherein the data traffic is the traffic collected by the application probe according to the traffic collection rule information set.

3. The method according to claim 2, wherein, The method further includes: In response to receiving at least one new traffic collection rule information sent by the target terminal, for each of the at least one new traffic collection rule information, the following processing steps are performed: Determine whether the newly added traffic collection rule information is the same as any traffic collection rule information in the traffic collection rule information set; In response to determining that the newly added traffic collection rule information is different from any traffic collection rule information in the traffic collection rule information set, the newly added traffic collection rule information is added to the traffic collection rule information set to update the traffic collection rule information set.

4. The method according to claim 1, wherein, The data traffic includes attribute information, which is initially empty; as well as The step of tagging the data traffic based on the container deployment version information to generate tagged data traffic includes: The container deployment version information is added to the attribute information included in the data traffic to update the attribute information and to identify the updated traffic information as tagged data traffic.

5. The method according to claim 1, wherein, The step of clustering the obtained security analysis traffic to generate clustered analysis traffic sets includes: The security analysis traffic with the same container deployment version information is clustered to generate clustered analysis traffic sets.

6. A multi-application security testing device, comprising: The processing unit is configured to, in response to receiving application deployment completion information, perform the following processing steps for each container corresponding to the deployed application: in response to the current time being a preset startup time, start the application probe; obtain the network protocol address of the current container, and query the corresponding container deployment version information based on the network protocol address; The system receives data traffic collected by the application probe and tags the data traffic according to the container deployment version information to generate tagged data traffic. Perform security analysis on the marking data traffic to generate security analysis traffic; wherein, performing security analysis on the marking data traffic to generate security analysis traffic includes: The tagged data traffic is sent to a preset security engine, wherein the preset security engine includes a preset set of security algorithms; Based on the preset security algorithm set included in the preset security engine, the tagged data traffic is subjected to security analysis to generate risky traffic; Based on the tagging information included in the risk traffic, risk container information is determined, and the risk container information is added to the tagging data traffic to update the tagging data traffic and obtain security analysis traffic; The step of sending the tagging data traffic to the preset security engine includes: Obtain data forwarding interface information; Based on the data forwarding interface information, determine the target forwarding interface; According to the target forwarding interface, the tagged data traffic is sent to the preset security engine; Clustering units are configured to cluster the obtained security analysis traffic to generate clustered analysis traffic sets; The stop unit is configured to control each target container to stop running based on the cluster analysis traffic set and the determined container deployment version information.

7. An electronic device, comprising: One or more processors; A storage device on which one or more programs are stored; When the one or more programs are executed by the one or more processors, the one or more processors implement the method as described in any one of claims 1 to 5.

8. A computer-readable medium having a computer program stored thereon, wherein, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 5.

Images